Www.adventhealthresearchinstitute.com



PURPOSEThis guidance describes the regulations surrounding HIPAA privacy in research and confidentialityBACKGROUNDThe FH IRB acts as the privacy board for research involving human subjects at Florida Hospital. The Privacy Regulations of the Health Insurance Portability and Accountability Act (HIPAA Privacy Rule) regulate the use and/or disclosure of protected health information. The HIPAA Privacy Rule imposes obligations on investigators when using and disclosing protected health information for research purposesProtected Health Information (PHI): The term “PHI” is a two-part definition that involves the concept of individually identifiable health information and protected health information.Individually Identifiable Health Information. Information that is a subset of health information, including demographic information collected from an individual, and:Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; andThat identifies the individual; orWith respect to which there is a reasonable basis to believe the information can be used to identify the individual.Protected Health Information. Individually identifiable health information that is or has been transmitted or maintained in any form or medium, with the exception of education records covered under the Family Educational Right and Privacy Act; the healthcare records of students at post-secondary educational institutions or of students 18 years of age or older, used exclusively for their health care treatment and which have not been disclosed to anyone other than a health care provider at the student’s request; and employment records maintained by an employer.Use versus Disclosure:The term “Use” is defined as the sharing, employment, application, utilization, examination or analysis of PHI maintained by FH within FH.The term “Disclosure” is defined as the release, transfer, provision of access to or divulging of PHI in any manner outside FH.Notice of Privacy Practices: FH’s Notice of Privacy Practices is offered to all individuals who receive treatment, including research related treatment, from FH.Minimum Necessary Restriction: With some exceptions, the Privacy Rule imposes a minimum necessary requirement on all permitted uses and disclosures of PHI by a covered entity. This means that researchers must limit use/disclosures to "the information reasonably necessary to accomplish the purpose (of the sought or requested use or disclosure)." There are several exceptions to the minimum necessary requirements that may affect investigators. The minimum necessary standard does not apply to the following:Uses and disclosures made with an individual's Authorization.Disclosures to, or requests by, a health care provider for treatmentDisclosures to the individualUses or disclosures required by lawDisclosures to HHS for purposes of determining compliance with the Privacy RuleWhen required for compliance with other HIPAA rules, e.g., to fill out required or situationally required data fields in standard transactions.GUIDANCEUtilizing Protected Health Information (PHI) in Research – investigators submitting a research study for IRB review and approval may meet the HIPAA Privacy Rule requirements as follows: Authorization to Use or Disclose Protected Health Information (Authorization) – This form must be used when researchers plan to obtain an authorization to use protected health information from research participants. The Florida Hospital IRB combines this authorization into the FH IRB research consent form templates and the following required elements are included:The Authorization is an individual’s signed permission to allow FH, investigators, and research staff to use or disclose the individual’s PHI that is described in the Authorization for the purposes and to the recipients stated in the Authorization.The Authorization must be written in plain language and a copy of the signed Authorization must be given to the individual. An Authorization is not valid unless it contains all the following required elements and statements:Description of PHI to be used or disclosed;Names or other specific identification of person or classes of persons authorized to make the requested use or disclosure;Names or other specific identification of the persons or classes of persons who may use the PHI or to whom FH, investigators, and research staff may make the requested disclosure;Description of each purpose of the requested use or disclosure (investigators should note that this element must be research study specific, not for future unspecified research);Authorization expiration date or event that relates to the individual or to the purpose of the use or disclosure (the terms “end of the research study” or “none” may be used for research, including for the creation and maintenance of a research database or repository);Signature of the individual and date. If the Authorization is signed by an individual’s personal representative, a description of the personal representative’s authority to act for the individual;Explanation of individual’s right to revoke his/her Authorization in writing and either (1) the exceptions to the right to revoke and a description of how the individual may revoke his/her Authorization or (2) reference to the corresponding section(s) of FH’s Notice of Privacy Practices which describes how an individual may revoke his/her Authorization;Notice of FH’s inability to condition treatment, payment, enrollment, or eligibility for benefits on signing the Authorization, with the exception that FH may condition participation in the research study on signing the Authorization and that individuals who do not sign the Authorization will not be allowed to participate in the research study;The potential for the PHI to be re-disclosed by the recipient and no longer protected by the HIPAA Privacy Rule. This statement does not require an analysis of risk for re-disclosure but may be a general statement that the HIPAA Privacy Rule may no longer protect the PHI once the PHI has been disclosed to the recipient;A statement that in order to maintain the integrity of this research study, the individual will not have access to their PHI related to this research study until the study is complete. At the conclusion of the research study and at the individual’s request, the individual will have access to their PHI that was maintained under this research study; andA statement that if the individual revokes the Authorization, the individual may no longer be allowed to participate in the research study described in the Authorization.The IRB may, at its discretion, permit changes to the Authorization as long as the Authorization retains the elements required by and is consistent with applicable law.HRP-220 Waiver of HIPAA Authorization Request Form - Complete /submit this form if the researcher plans to waive the requirement to obtain an individual’s authorization as described above. The HRP-220 Waiver of HIPAA Authorization Request Form submitted by the investigator must indicate that the Waiver of Authorization satisfies the following criteria:The use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals, based on at least the presence of the following elements: (i) an adequate plan to protect the identifiers from improper use and disclosure; (ii) an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and (iii) adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted by the HIPAA Privacy Rule;The research could not practicably be conducted without the waiver or alteration; and,The research could not practicably be conducted without access to and use of the PHI.The HRP-220 Waiver of HIPAA Authorization Request Form submitted by the investigator must briefly describe the PHI for which use or access has been requested.The IRB will document/communicate review of the request for the Waiver of Authorization as follows:Statement in the form of a letter that the FH IRB approved or denied the Waiver of Authorization and the date of such approval or denial.Brief description of the PHI for which use or access has been determined to be necessary or not to be necessary by the IRB.Specify whether the Waiver of Authorization was reviewed by the IRB under normal or expedited review procedures.HRP-221 Reviews Preparatory to Research Form For activities involved in preparing for research, covered entities may use or disclose PHI to a researcher without an individual’s Authorization, a waiver or an alteration of Authorization, or a data use agreement. However, the covered entity must obtain from a researcher representations that (1) the use or disclosure is requested solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research, (2) the PHI will not be removed from the covered entity in the course of review, and (3) the PHI for which use or access is requested is necessary for the research. The covered entity may permit the researcher to make these representations in written or oral form.The purpose of this form is to document the use or disclosure of PHI for research purposes without obtaining prior written authorization from each individual.The HRP-221 Reviews Preparatory to Research Form must confirm:Use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research such as screening and enrollmentNo PHI is to be removed from FH by the investigator or the investigator’s staff in the course of the review.The PHI for which use or access is sought is necessary for the research purposes.The HRP-221Reviews Preparatory to Research Form must be completed and signed by each member of the research team as described above.The HRP-221 Reviews Preparatory to Research Form must be submitted to the IRB Administrative Office for review and approval.Upon approval, PHI can be accessed for protocol feasibility/development i.e. the HRP-221 Reviews Preparatory to Research Form may be presented to the Health Information Management Department for access to PHI.Upon approval of the HRP-221 Reviews Preparatory to Research Form, PHI can be accessed in order to contact or recruit individuals to participate in a research study without the individual’s prior authorization.De-Identification – Under the HIPAA Privacy Rule, an investigator may use health information for research without the individual’s authorization if the information is de-identified. PHI may be de-identified if the following identifiers are removed:Name;All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, geocodes (in some instances, the first three numbers of a ZIP code may be collected);All elements of dates (except year) directly related to an individual including birth date, admission and discharge date, date of death, all ages over 89 unless aggregated into a category age 90 or older;Telephone numbersFax numbers;Email addresses, web universal resource locators, and internet protocol addresses and numbers;Medical record, health plan beneficiary, and account numbers;Certificate/license numbers;Vehicle identification and serial numbers, including license plate numbers;Device identifiers and serial numbers;Biometric identifiers, including finger and voice prints;Full face photographic images and any comparable images;Any other unique identifying number, characteristic, or code that could be used alone or in combination with other information to identify the individual;PHI may be de-identified by an expert of statistical and scientific principals and methods for rendering information not individually identifiable, when the expert determines that the risk is “very small” that the information could be used alone or in combination with other reasonably available information by an anticipated recipient to identify an individual. The expert must document the principals and methods used to make such determination.Link Fields – a link field is a code that allows you to get back to the original, identified PHI. The link field is a list of random letters or numbers that match up the stripped data with its original form. As long as the link field is totally unrelated to any identifier of the subject, it is allowed under HIPAA Privacy. However, if the link field is included with the rest of the data sent to the sponsor, the data are still considered identified. Patient authorization or a waiver from the IRB will then be needed. If the link field is removed and/or destroyed, the data are considered both de-identified and anonymized. Anonymized data are exempt from HIPAA oversight.Limited Data Sets and Data Use AgreementsThe Limited Data Set is a subset of PHI that investigators may disclose for research purposes to recipients who have signed a Data Use Agreement. The identifiers that must be removed from a Limited Data Set include:Name;Street address or post office box number;Telephone and fax numbers;Vehicle identification numbers and serial numbers, including license plate numbers;URLs, IP addresses, and email addresses;Full face photographs and any comparable images;Social security numbers;Medical records numbers;Health plan beneficiary numbers and other account numbers;Device identifiers and serial numbers;Biometric identifiers, including finger and voice prints;Certificate or license numbers.Identifiers that may be included in a Limited Data Set are:CityStateZIP codeElements of DatesOther numbers, characteristics, or codes not listed as direct identifiers. A Data Use Agreement requires the recipient of the Limited Data Set to agree to the following stipulations:Not to use or disclose PHI except as necessary to fulfill the research purposes of the agreement;Not to use or further disclose the Limited Data Set in a manner that would violate the HIPAA Privacy Rule if done by FH;Not to use or further disclose the Limited Data Set other than as permitted by the agreement or otherwise required by law;To use appropriate safeguards to prevent use or disclosure of the Limited Data Set other than as provided for by the agreement;To report to FH any use or disclosure of the Limited Data Set not provided for by the agreement of which recipient becomes aware;To ensure that any agents, including a subcontractor, to whom it provides the Limited Data Set agrees to the same restrictions and conditions that apply to the recipient with respect to such information;Not to identify the individuals who are the subjects of the Limited Data Set or contact such individuals; andTo use or disclose to its subcontractors, agents or other third parties, and request from FH, only the minimum necessary PHI needed for the Limited Data Set to perform or fulfill a specific function required or permitted in the agreement.Research on Decedents – The HIPAA Privacy Rule allows an investigator to use PHI of decedents if an investigator represents to the IRB that:The use or disclosure of PHI is sought solely for research on PHI of decedents.Investigator will provide documentation, at the request of the IRB or FH, of the death of the individual(s).The PHI for which use or disclosure is sought is necessary for the research study.Accountings for Disclosures – The HIPAA Privacy Rule indicates that an individual has a right to an accounting of how FH uses the individual’s PHI under certain circumstances.No accounting of disclosures is required for disclosures made pursuant to a Data Use Agreement or an Authorization.No accounting of disclosures is required to carry out treatment, payment or health care operations.No accounting of disclosures is required if the disclosure is to the individual who is the subject of the PHI.No accounting of disclosures is required if the disclosure is incidental to a use or disclosure otherwise permitted or required by the HIPAA Privacy Rule.No accounting of disclosures is required for disclosures made to persons involved in the individual’s care, to respond to emergency circumstances or for disaster relief purposes.No accounting of disclosures is required for disclosures to correctional institutions or law enforcement.85No accounting of disclosures is required for national security or intelligence purposes.86When disclosures of PHI are made for a research study involving 50 or more individuals, and the individuals did not sign an Authorization or the investigator did not obtain a Data Use Agreement, an investigator may provide a general accounting of disclosures as follows:The name of the protocol or other research activity.A description of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records.A brief description of the type of PHI that was disclosed.The date or period of time during which such disclosure occurred, or may have occurred, including the date of the last such disclosure during the accounting period.The name, address, telephone number of the sponsor and the investigator to whom the PHI was disclosed.A statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity.When public health authorities have access to all medical records of FH or a designated portion of FH’s medical records that include research records, FH or the investigator does not have to make a notation in every medical record, but may maintain a separate log for such disclosures and must consult this separate log when responding to a request from an individual regarding an accounting of disclosures.All disclosures that do not meet the exemptions above and are within a six (6) year period prior to the date of the request for counting must be accounted for as follows:The date of the disclosure.The name of the entity or person who received the PHI and address of such entity or person if known.A brief description of PHI disclosed.A brief statement of the purpose of the disclosure or a copy of the written request for the disclosure.If multiple disclosures have been made to the same person or entity, the frequency, periodicity or number of the disclosures may be notated, as well as the last date of the disclosure during the accounting period.Business Associates – The HIPAA Privacy Rule requires business associate agreements between FH if an individual or entity, i.e., a business associate, is providing a service or function for or on behalf of FH that involves the use or disclosure of PHI. In the event a business associate agreement is required, the business associate must agree as follows:Only use or disclose PHI received from FH to its officers, employees, subcontractors and agents for the purpose of providing services to FH; as directed by FH; and as otherwise permitted by the agreement.Only use or further disclose the PHI as allowed under the agreement or applicable law.Only use or further disclose PHI in a manner that would not violate the HIPAA Privacy Rule if done so by FH.Establish and implement safeguards to prevent improper uses or disclosures of PHI and procedures for mitigating, to the greatest extent possible under the circumstances, any deleterious effects from any improper use or disclosure of PHI that business associate reports to FH.Report to FH’s Privacy Officer, in writing, any use or disclosure of the PHI not permitted or required by the agreement of which business associate becomes aware within two days of business associate’s discovery of such unauthorized use or disclosure.Ensure that business associate’s subcontractors or agents to whom business associate provides PHI, received from or created or received by the business associate on behalf of FH, agree to the same restrictions and conditions that apply to the business associate with respect to such PHI, and ensure that such subcontractors or agents agree to establish and implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of FH.Make business associate’s records, books, agreements and policies, and procedures relating to the use and disclosure of PHI received from, or created or received by business associate on behalf of FH, available to the Secretary for purposes of determining FH’s compliance with the HIPAA Privacy Rule.Use or disclose to its subcontractors, agents or other third parties, and request from FH, only the minimum PHI necessary to perform or fulfill a specific function required or permitted hereunder.Provide information to FH to permit FH to respond to a request by an individual for an accounting of disclosures, within 15 days of receiving a written request from FH, if business associate maintains a Designated Record Set on behalf of FH.At the request of, in the time and manner designated by FH, provide access to the PHI maintained by business associate to FH or individual, if business associate maintains a Designated Record Set on behalf of FH.At the request of, and in the time and manner designated by FH, make any amendment(s) to the PHI when directed by FH, if business associate maintains a Designated Record Set on behalf of FH.Establish and implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic PHI business associate creates, receives, maintains or transmits on behalf of FHReport to FH any security incident of which business associate becomes awareThe business associate may use or disclose PHI received by FH pursuant to the agreement for: (1) the proper management and administration of the business associate; or (2) to carry out the legal responsibilities of the business associate. However, the business associate will only be allowed to disclose PHI for the aforementioned uses if: (1) the disclosure is required by law; or (2) the business associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, AND the person notifies the business associate of any instances in which the person is aware of a confidentiality breach of PHI.The business associate may combine such PHI it has received from FH with the PHI received by the business associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities, if data analyses is part of the services that business associate is to provide to FH.At termination of agreement, if feasible, return or destroy all PHI received from, or created or received by the business associate on behalf of FH and retain no copies or, if such return or destruction is not feasible, extend protections of the agreement and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.The agreement must authorize FH to terminate the agreement if the business associate has violated a material term of the agreement.Reporting Abuses - All investigators and their research staff must adhere to privacy and confidentiality policies of FH. Violations or suspected violations should be reported to the IRB and the FH Privacy office per policies and guidance. RESOURCESNIH webpage provides a wealth of information on the HIPAA Privacy Rule: fact sheet titled “Institutional Review Boards and the HIPAA Privacy Rule” booklet developed explicitly for researchers, titled “Protecting Personal Health Information in Research:? Understanding the HIPAA Privacy Rule.” ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download